CVE-2026-1714

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns.

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns.

El plugin ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution para WordPress es vulnerable a Abuso de Retransmisión de Correo Electrónico en todas las versiones hasta la 3.3.2, inclusive. Esto se debe a la falta de validación en los parámetros 'send_to', 'product_title', 'wlmessage' y 'wlemail' en el endpoint AJAX 'woolentor_suggest_price_action'. Esto hace posible que atacantes no autenticados envíen correos electrónicos arbitrarios a cualquier destinatario con control total sobre la línea de asunto, el contenido del mensaje y la dirección del remitente (mediante inyección CRLF en el parámetro 'wlemail'), convirtiendo eficazmente el sitio web en un retransmisor de correo electrónico completo para campañas de correo no deseado o phishing.